Call us now:
US Federal Government is on a role of cybersecurity announcements as it drives ahead with legislation and implementation to protect National Infrastructure from Cyberattacks. The announcement by the Department Of Justice (DoJ) that it plans to use the False Claims Act (FCA) as a mechanism to prosecute Federal contractors if the fail to report cyber incidents, is one to watch.
There is plenty of precedent set for the use of the FCA as a regulatory tool. There is existing Federal regulation in place that focuses on cyber and information security for the DoJ to use, such as FISMA, DFARS 252.204 – 7012 (Defence contractors – CUI and incident reporting) and OFAC. Regulations that set out requirements for Federal contractors to implement cyber-risk management, cybersecurity standards and report incidents. To form test cases and create precedent.
The recent Treasury announcement of OFAC reporting, the Securities and Exchange Commissions (SEC) proposal to create Cyber Risk Governance regulation, updates to FISMA, the DoDs plans for CMMC and I have no doubt there are other cyber regulations in the pipeline. Set out Federal regulations that provide foundations from which the implementation of cyber security, risk management and incident reporting cases could be built.
I do have an observation, if the DoJ move ahead with their proposal. How far down the Supply Chain could the FCA be applied, as the Federal contractor base is international. The DoD is a case in point. If contractors fail to implement regulations, report an incident and/ or deal with Treasury OFAC request, would the DoJ prosecute a contractor further down the domestic or international supply chain? Or would they, for example under DFARS 252.204 – 7012 requirements, that should be flowed-down the supply chain prosecute a Prime or subcontractor. If they failed to flow down DFARS and report an incident?
Ted Dziekanowski Brian McCarthy Jason Spezzano
#ransomware‚Â #fisma‚Â #ofac‚Â #theaugustagroup‚Â #theaugustaplan‚Â #cybersecurity‚Â #supplychainriskmanagement‚Â #cyberriskmanagement‚Â #compliance‚Â #regulatorycompliance‚Â #regulatoryoversight‚Â #esg‚Â #scrm‚Â #cscrm #fca
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A6851769540808851456